How To Protect Yourself from a Sim Swap

SIM swap, also known as SIM swapping, SIM hijacking, or port-out scam, is a type of identity theft where fraudsters trick mobile carriers into transferring your phone number to a SIM card they control. Once they have control of your phone number, they can access various accounts tied to your number, including bank accounts, social media profiles, and email accounts.

The other night, my phone had no service connection for about two hours. I got on my laptop and chatted with a phone representative for about an hour before my service suddenly came back. I chalked it up to a fluke incident, and disconnected from the chat. Then I started getting notifications.

My email had been accessed from an unfamiliar device. My H&R Block password had been changed. I checked my bank accounts on a hunch, and both showed $0 amounts. Each had the entire balance transferred through a Spin transaction. I called Visa to report fraud and freeze my card. I called H&R Block to report the fraud. I put a freeze on my credit.

The next morning I went to my bank to report the fraud as soon as they opened. The transaction was still pending. I explained the situation, and they said they’d look into it. I filed a police report as well. The next day they say that my online account was accessed, and that since the scammer knew my login, it was an authorized transaction. They said there was nothing they could do to get my money back.

How SIM-Swapping Works

1. Gathering Information: The fraudster begins by collecting personal information about the victim. This can be done through phishing emails, social engineering, or purchasing data from the dark web. For well-known individuals or public figures, this information may sometimes be available through a simple Google search. It can also be obtained from individuals in the victim’s immediate circle, such as employees or someone with a grudge. The information may also be found online in data breaches or purchased for a small fee from a fraudulent telecom provider employee.

2. Contacting the Mobile Carrier: Armed with the gathered information, the hacker contacts the victim’s mobile carrier, impersonating the victim. They claim to have lost their phone and request a SIM swap, transferring the phone number to a new SIM card in their possession.

3. Verification Process: Telecom providers ask a series of security questions to verify the caller’s identity. These questions typically include the victim’s name, address, date of birth, and sometimes the last four digits of their bank account number. If the hacker has enough information, they can successfully answer these questions.

4. Gaining Control: Once the SIM swap is complete, the hacker’s SIM card is now associated with the victim’s phone number. They can receive calls, texts, and most importantly, two-factor authentication (2FA) codes sent to the number.

5. Accessing Accounts: With control over the phone number, the hacker can reset passwords and gain access to various accounts, including email, social media, and banking accounts. They can use the 2FA codes sent to the number to bypass security measures.

Human Error

Many call center employees are poorly paid, temporary workers, or students who may not know or adhere to all procedures. Some providers make it so easy to manipulate that customers need to answer only “three out of five security questions” correctly before any changes can be made over the phone. This creates a vulnerability that hackers can exploit, making SIM-swapping successful.

How to Protect Yourself from SIM Swap

SIM swap attacks are often seen as non-demanding in terms of hackers’ technical skills, making it essential for users to be diligent with their identity security to prevent such hacks.

1. Avoid SIM Card-Based 2FA: The primary defense against SIM swap hacks is to restrict the usage of SIM card-based methods for two-factor authentication (2FA). Instead of relying on methods like SMS, use authentication apps like Google Authenticator or Authy. These apps provide a more secure form of 2FA that is not susceptible to SIM swap attacks.

2. Multifactor Authentication: Implement multifactor authentication wherever possible. This adds an additional layer of security beyond just passwords and 2FA, making it harder for hackers to gain access to your accounts.

3. Enhanced Account Verification: Enable enhanced account verification on your online accounts. This includes setting up additional passwords or security questions that must be answered before any changes can be made to your account.

4. Strong PINs and Passwords: Establish strong PINs or passwords for your SIM card and mobile phone accounts. A strong PIN or password can prevent unauthorized access and add an extra layer of security.

5. Protect Personal Data: Safeguard your personal data such as your name, address, phone number, and date of birth. Be cautious about sharing this information online and ensure it is not easily accessible to potential hackers.

6. Monitor Account Activity: Regularly scrutinize your online accounts for any anomalous activity. Early detection of suspicious behavior can help mitigate potential damage from a SIM swap attack.

7. Additional Verification for Account Changes: Advocate for platforms to require additional verification before allowing changes to account information. This can include sending an email notification or requiring a secondary form of identification to confirm the changes.

8. Educate Yourself and Others: Stay informed about the risks of SIM swapping and educate others. Awareness and education are key components in preventing SIM swap attacks. Platforms should also promote safe 2FA practices and inform users about the importance of securing their accounts.

By following these measures, you can significantly reduce the risk of falling victim to a SIM swap attack. Protecting yourself from SIM swap requires a combination of good digital hygiene, vigilance, and using advanced security practices. Stay informed and stay secure.